Current safeguards
- Static export hosted behind Cloudflare CDN and TLS.
- No account passwords, payment data, public chart storage, or cloud project database.
- Image extraction, color conversion, palette files, chart tables, CSS and design-token parsing, and ICC signature checks run locally in the browser.
- Chart imports validate extension, reported MIME, size, row count, column count, cell length, and JSON nesting depth before use.
- Chart labels are length-constrained and escaped in SVG and HTML; exported CSV cells are protected against spreadsheet-formula injection.
- Web Workers are compiled to JavaScript and can be cancelled. Runtime code generation is not used.
- Security headers restrict framing, MIME sniffing, permissions, referrers, and insecure requests.
- Dependencies are checked with TypeScript, ESLint, production builds, fixtures, and vulnerability audits before release.
What users should do
Keep a trusted browser updated, avoid importing unknown files, verify downloaded data before production use, and keep exported project backups. Browser storage is not a secure secrets vault.
Responsible disclosure
Report a reproducible vulnerability through the Contact page. Include the affected URL, browser, impact, and minimal reproduction steps. Do not access other users’ data, disrupt availability, or publish exploit details before remediation.
No absolute security guarantee
No website can honestly promise to be completely “hacker-proof.” Color Pick applies practical defense-in-depth controls and documents remaining limitations.